4. Methods

There are several possible approaches to ISS. The first, and simplest, is the purely technical approach, with no explicit security policy: you don't want to touch the existing organization at all, just install a device that filters flows, logs service requests or partitions the network, for example. This type of security relies on automatic systems and corresponds to a predefined security "model" that is applied "intuitively" without any prior study. Poor, unspecified and requiring little effort to design and implement, it offers protection only against low-intensity threats. Does it protect against internal malicious acts? Have all the consequences of a security incident been considered? Do we know how to recover from a disaster? These and many other unanswered questions will resurface with force when the time comes. This way of thinking stems from concepts that are still very much in...